06 March 2013

List of UPX Illiterate AntiVirus

I want to make a black campaign and my target is some consistently ignorant AntiVirus makers.
Thanks to virustotal.com for make this painless

Simple case:
1. gplc.exe (gnu prolog) https://www.virustotal.com/en/file/9e2acb4176669e48f7a0aadd3fcbb39ade979b8843be87db9da5a42fe10ec290/analysis/1362534179/
2. pack gplc.exe with UPX https://www.virustotal.com/en/file/381976956f94d747407e9beaa9231dacdbd6bc19093621cc8058a3bbd09f3b06/analysis/1362534370/
3. unpack packed gplc.exe with UPX https://www.virustotal.com/en/file/86323543730fc67432854d6ff4eceaa6b0a8096befbce37fa6062d9e4450d4ff/analysis/1362534576/

The suspect file http://osspack32.googlecode.com/files/GPLC.7z

And the award goes to:

1. TheHacker
2. TrendMicro
3. TrendMicro-HouseCall

Now that's just a simple case, but if an executable involving networking functionality the analysis of our AV "champion" will goes into cosmic territory and hallucination... such pathetic and irresponsible (they will rely on user report) behavior should never exist in a software of AntiVirus caliber. More.. some big company make actually malware-behaving software and force AV maker to whitelist them as reported by nirsoft. But when false-positive involve open source technology it become ignorance

UPX itself is an open source software to compress executable.

So stay tuned with this page for most updated list of antivirus whose programmer can't read any single line of UPX source codez. ha ha

So what? Why just "don't use UPX" and that "UPX is useless, bla bla... anyway" ?
Well because we're human dude, and we fix our mistake !

2 comments:

  1. How come compressing and decompressing with UPX doesn't generate the same file? I thought it was a loseless compressor.

    ReplyDelete
  2. A ricochet then, do you ever use UPX yourself? cause I'm surprised you asked that.

    I think you mistaken UPX as some kind of 7zip, WinRAR or WinZip. It's true that UPX can use lzma method (used in 7z) but it works differently. I suggest to goggling what is PE a.k.a Portable Executable format. Which part compressed, which preserved, and which modified

    ReplyDelete